Cyber Essentials is the UK government-backed scheme that shows your business has basic protection against the most common cyber attacks. It is increasingly requested by clients, insurers and supply chains, and it is required for many public sector contracts.

There are two levels: Cyber Essentials and Cyber Essentials Plus. Both cover the same controls. The difference is how they are checked.

The five controls

Both levels assess the same five technical controls:

  • Firewalls: protecting your internet connection and devices from unauthorised access.
  • Secure configuration: removing default passwords, unnecessary accounts and software.
  • User access control: making sure people only have the access they need, with strong authentication.
  • Malware protection: stopping malicious software from running.
  • Security update management: keeping operating systems and applications patched.

Cyber Essentials: a verified self-assessment

For Cyber Essentials, your organisation completes an online questionnaire describing how each control is met. A certification body reviews your answers and, if they meet the standard, awards the certificate. Nobody tests your systems directly, so accuracy depends on the answers you give.

Cyber Essentials Plus: independently tested

Cyber Essentials Plus includes the same questionnaire, followed by a hands-on technical audit by an assessor. That typically includes vulnerability scanning, checks on a sample of devices and tests of how your email and browsers handle malicious content. It gives clients and insurers much stronger assurance because the controls have been verified, not just described.

In short: Cyber Essentials says you have the controls in place. Cyber Essentials Plus proves it.

Which one do you need?

If a contract, client or insurer specifies a level, that decides it. Otherwise, Cyber Essentials is a sensible first step for most small businesses, and Plus is worth it if you handle sensitive client data, work in regulated sectors such as legal or finance, or want to stand out in tenders.

Both certificates need renewing every year, and the requirements are updated periodically, so it pays to treat certification as an ongoing process rather than a one-off project.

How Equasys can help

Equasys is Cyber Essentials Plus certified ourselves. We help clients review their current setup against the controls, fix the gaps, complete the questionnaire and prepare for the Plus audit. Find out more about our managed cyber security services or get in touch.